Key Takeaway
- AI agent control is how you define what an agent is and is not allowed to do, and that boundary has to be in place before the agent takes its first action.
- An agent can pass every individual check and still cause damage across a session: ten small buys that add up, or a sequence of steps that looks fine individually but goes badly wrong together.
- Amazon Bedrock AgentCore now has two built-in controls: gateway rate limiting and temporal policies. Rate limiting caps what agents can spend or consume. Temporal policies enforce rules across an entire session, not just one request at a time.
- Temporal policies use Dogwood, an open-source language built on Cedar, so your compliance team can read and audit the rules directly, not just trust that they exist.
- For businesses in Malaysia deploying AI agents on AWS, these controls apply at the gateway level, with no code changes needed to your existing agents.
Introduction
When you give an AI agent access to your systems, the risk is not that it refuses to work. The risk is that it works too well, in the wrong direction, without stopping.
An agent with access to your systems can take real actions on your behalf: buying, messaging, updating, approving. Each of those can also go wrong. When it does, the failure is rarely one bad action in isolation. Each step looks fine on its own. The combined result can be something nobody on your team signed off on.
AI agent control is how you prevent that: not by reviewing what the agent did after the fact, but by setting what it is allowed to do before each call goes through.
Why Monitoring Alone Does Not Keep AI Agents Safe
Monitoring tells you what happened. AI agent control decides what is allowed to happen.
Teams typically start with monitoring: logs, alerts, dashboards. That works fine for agents that produce text or summaries. For agents that take real actions (placing orders, sending emails, updating databases), catching a problem after it has already executed can be too late to reverse.
The Action Gap
Agent behaviour management at the gateway level means the policy runs before the agent’s call reaches your system. The agent cannot see the policy, cannot work around it, and every denied call is logged with the reason why.
The Session Gap
Standard policy checks look at each request in isolation. But a real-world failure can span multiple actions where each individual step is permitted, and the combined result is not: a budget overspent one small transaction at a time, or a sequence of steps that only becomes a problem when they happen together.
An agent that sets its own limits can also undo them. The policy layer has to sit outside the agent to mean anything.
How Gateway Rate Limiting Keeps Agent Costs Predictable
Gateway rate limiting in Amazon Bedrock AgentCore caps what individual users, teams, or agents can consume, across every tool, model, and agent sitting behind the gateway.
Three types of limits, each targeting a different cost problem:
| Limit type | What it controls | Problem it prevents |
| Request count | Number of calls in a time window | Retry loops that run up volume without producing output |
| Tokens processed | Volume of text sent to and from a model | Tasks that require heavy reasoning and generate far more tokens than expected |
| Duration of held connections | How long a session can hold an open gateway connection | Long-running sessions that stay connected indefinitely |
You configure the limits at the gateway. Your existing agents need no code changes. Different users, teams, and agents can carry different ceilings, so a developer testing an agent stays well below production limits without anyone touching the agent itself.
If you are still working out where AWS fits in your setup, Amazon Bedrock in Malaysia covers the foundation these controls build on.
How Temporal Policies Enforce Rules Across a Full Session
Rate limiting handles cost. Temporal policies handle AI risk control at the behaviour level, and they work differently from standard per-request checks.
Standard checks ask: is this individual action permitted? Temporal policies ask: is this action permitted given everything this agent has already done in this session?
AWS has published detailed guidance on AgentCore’s control capabilities for teams evaluating how these policies work in practice. Here is what they enable:
Prerequisite Checks
A financial agent can be required to look up an account number before transferring funds to it. Any transfer to an account it did not explicitly retrieve first gets blocked automatically.
Cumulative Budgets
A buying agent can carry a cumulative session budget. Ten small buys that exceed the session limit get caught before the tenth one goes through, even if each buy is below the per-transaction ceiling.
Human Approval Gates
An agent that needs human approval before a high-value action must have that approval recorded in the session. Without it, the action cannot proceed.
Automatic Permission Narrowing
Permissions can narrow automatically when a person stops engaging, reducing what the agent can do during unattended periods.
Policies run at the gateway, not inside the agent. The agent cannot see or override the logic. Every blocked call is logged with the context that triggered it, so your team can see exactly why something was denied and reproduce the decision.
What Is Dogwood and Why Does the Policy Language Matter?
Dogwood is the open source policy language behind AgentCore’s temporal policies. Built on Cedar (the same policy language AWS uses for Amazon Verified Permissions) and licensed under Apache 2.0, it brings structured agent behaviour management to teams who need policies they can read and defend.
A standard policy says: “this identity is allowed to call this endpoint.” A Dogwood policy can say: “this identity is allowed to call this endpoint, provided it has already called that other endpoint first, and provided it has not done so more than twice in this session.”
The constructs Dogwood adds that standard languages do not have:
Rate Limits Within a Session
Cap how many times an action can be taken before a threshold triggers a review or a block.
Time Windows
Restrict actions to specific periods, so an agent cannot do after-hours what it could do during business hours.
Prerequisite Step Checks
Require that one action completes successfully before another is permitted. No skipping steps.
Escalation Triggers
Flag specific conditions for human review before an action proceeds, rather than blocking outright.
Because Dogwood is an open specification, the evaluation logic stays readable. Your compliance or legal team can review the written policy, trace any blocked call to the exact rule that applied, and verify the gateway is enforcing what the policy says. For AI governance in regulated industries, that auditability turns a policy document into something you can show a regulator.
When your compliance team can read the policy language and the decision log ties every blocked call to a specific rule, governance stops being a document and becomes something you can defend.
What This Means for Malaysian Businesses Running AI Agents on AWS
Businesses deploying AI agents in Malaysia can face this challenge: the agent goes into production before the governance layer is properly in place. The team is focused on what the agent can do, not yet on what it should be prevented from doing.
AgentCore’s controls do not require a rebuild. Through VSTECS KU’s AWS cloud solutions, you can add rate limits and temporal policies to agents already running on Bedrock as a configuration step. No rearchitecting. No code changes to the agents themselves.
For industries with AI governance requirements such as finance, healthcare, and public sector, temporal policies produce a structured audit log of every blocked call, the context that triggered the block, and the rule that applied. That log is evidence of AI risk control in operation, not just governance that exists on paper.
Frequently Asked Questions
1. Why do AI agents need rules before they can act independently?
Because an agent that can act can also act wrongly, and once an action has executed, it may not be reversible. An agent placing orders, sending messages, or updating records does not pause to ask if the overall outcome makes sense. AI agent control sets the boundaries before execution, not after. Without it, the only check on the agent is the agent itself.
2. What happens if you deploy an AI agent without controls in place?
The agent operates on its own code alone. A single unexpected input, a retry loop, or a sequence of permitted steps that adds up to an unpermitted outcome can all go through unchecked. You will only find out when the bill arrives, when a user complains, or when someone notices the agent did something it should not have.
3. Can an AI agent get around its own rules?
Not if the rules sit outside the agent. When a policy runs inside the agent’s own code, it can be bypassed by a prompt injection, an unexpected input, or a code path that was not anticipated. When the policy runs at the gateway instead, the agent has no visibility into it and no way to override it.
4. Do you need to rewrite your agents to add these controls?
No. You configure both gateway rate limiting and temporal policies at the gateway layer, outside the agents themselves. Agents already running on Bedrock get the controls without a code change. That also means every agent behind the gateway follows the same rules automatically, without each one needing its own implementation.
5. What makes temporal policies different from a standard usage limit?
A standard usage limit asks: has this request exceeded the permitted threshold on its own? A temporal policy asks: has this request exceeded a threshold given everything that has happened in this session? That distinction matters for cumulative risks: a budget overspent across ten transactions, a sequence of steps that requires prior approval, or permissions that should narrow when the user is no longer present. Standard limits miss all of these.
An AI agent without rules is simply unpredictable. Getting AI agent control right before your agents go anywhere near production is the step that separates a useful deployment from a risky one. The controls do not slow your agents down. They make it possible to give them more access, with confidence, because the boundaries are already in place. VSTECS KU’s AWS professional services team can help you set up AgentCore’s gateway controls, write Dogwood policies that match your business rules, and build the governance layer your agents need to operate safely.